General
- Target https://github.com/leventemargli/Sepsis.vbs-VBS-Malware/blob/main/Sepsis.vbs
- Sample260625-ttxdpsds8y
Score
10/10
Malware Config
Targets
-
- Target https://github.com/leventemargli/Sepsis.vbs-VBS-Malware/blob/main/Sepsis.vbs
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Event Triggered Execution: Image File Execution Options Injection
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4